Passing traffic through 6200P via bonded and bridged interfaces

jacowser — Wed, 27 Apr 2022 16:03:09 GMT

We are attempting to deploy a 6200 between Cisco switch stacks via bridged interfaces. Topology is such that Stack 1 connects to Stack 2 and Stack 3 via separate 2 port Etherchannels). We have configured the Checkpoint with 2 Bridge interfaces (comprised of 2 bonds each).

In limited testing, this deployment appears to be working okay. However, when attempting to move to production, certain traffic doesn't pass, even with an Any Any allow rule. There are a lot of "Data received before SYN was acknowledged" entries in the logs. Any thoughts as to if this is somehow config related to the bridge or bond setups? There doesn't seem to be much in the way of options when configuring them.

Thanks for any assistance,

Jerry

Re: Passing traffic through 6200P via bonded and bridged interfaces

Chris_Atkinson — Thu, 28 Apr 2022 07:31:32 GMT

Those messages often related to a specific protection: "TCP SYN Modified Retransmission"

It's necessary to understand the specific traffic flow that is triggering this to determine if their is a networking problem or other cause that can be otherwise handled.

Refer also: sk63160: Aggregated TCP logs (Potential Network Configuration Problem)

topic Passing traffic through 6200P via bonded and bridged interfaces in Firewall and Security Management

Passing traffic through 6200P via bonded and bridged interfaces

Re: Passing traffic through 6200P via bonded and bridged interfaces